CVE-2026-81642

Katalog CVE

CVSS 9.8 · Critical EPSS 0,96%

Kerentanan Heap-based Buffer Overflow pada nlnetlabs unbound. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt mitigasi · patch · advisory vendor